From 2cf6e9f2fb507e89147594c985d7088151a37f57 Mon Sep 17 00:00:00 2001
From: Rafael Lopes <rafael.lopes@sothis.com.br>
Date: Wed, 15 Jul 2026 13:31:35 -0300
Subject: [PATCH] CI: Materializa .env.production via secret, backup pra
 rollback e node --check dinamico

Adiciona um step que escreve o .env.production a partir do secret ENV_PRODUCTION
do Gitea Actions (com chmod 600), eliminando o modelo anterior de manter esse
arquivo manualmente na VM sem nenhuma copia de seguranca. Um step anterior falha
cedo e com mensagem clara se o secret nao estiver configurado.

Antes de sincronizar o codigo novo, guarda a versao anterior em
$DEPLOY_PATH.previous, permitindo rollback manual rapido caso o deploy suba
algo quebrado (o node --check so pega erro de sintaxe, nao de logica).

Troca a lista fixa de arquivos validados por node --check (que ja estava
desatualizada, sem cobrir arquivos tocados em mudancas recentes) por uma
varredura em todo .js do projeto.
---
 .gitea/workflows/deploy-production.yml | 34 ++++++++++++++++++--------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/deploy-production.yml b/.gitea/workflows/deploy-production.yml
index 6822d2a..f37529f 100644
--- a/.gitea/workflows/deploy-production.yml
+++ b/.gitea/workflows/deploy-production.yml
@@ -27,15 +27,29 @@ jobs:
           pm2 --version
           rsync --version | head -n 1
 
+      - name: Check required secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then
+            echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
+            exit 1
+          fi
+
       - name: Validate JavaScript
         shell: bash
         run: |
           set -euo pipefail
-          node --check cron.js
-          node --check src/app.js
-          node --check src/controllers/processTicketLifecycleController.js
-          node --check src/services/servicenowService.js
-          node --check src/services/glpiTicketService.js
+          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
+
+      - name: Write .env.production from secret
+        shell: bash
+        run: |
+          set -euo pipefail
+          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
+          mkdir -p "$DEPLOY_PATH"
+          printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production"
+          chmod 600 "$DEPLOY_PATH/.env.production"
 
       - name: Deploy files and restart PM2
         shell: bash
@@ -53,6 +67,10 @@ jobs:
               exit 1
             }
 
+            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
+              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
+            fi
+
             rsync -az --delete \
               --exclude='.git/' \
               --exclude='.gitea/' \
@@ -75,11 +93,7 @@ jobs:
 
             npm ci --omit=dev
 
-            node --check cron.js
-            node --check src/app.js
-            node --check src/controllers/processTicketLifecycleController.js
-            node --check src/services/servicenowService.js
-            node --check src/services/glpiTicketService.js
+            find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
 
             pm2 startOrRestart ecosystem.config.js --env production
             pm2 save